Build a Password Strategy You Won't Abandon

Password advice has a compliance problem: it's technically correct and practically ignored. Telling someone to memorize forty unique sixteen-character strings is advice for a robot, not a human. A strategy only works if you can actually keep it up for years, not just the week after you read the article.

Use a password manager, full stop

A password manager is the single highest-leverage security tool available to an individual. It generates unique, high-entropy passwords for every account and remembers them so you don't have to. The cost of adopting one is a single afternoon; the payoff is that credential-stuffing attacks — where leaked passwords from one breach are tried against every other site — simply stop working against you, because no two accounts share a password.

Pick one with a strong track record of independent security audits, cross-platform apps, and support for passkeys. Whichever you choose, the one non-negotiable step is this:

Your master password is the one password you still have to remember. Make it a long passphrase — four or five random, unrelated words — and use it nowhere else.

Passphrases beat complexity rules

A phrase like correct-horse-battery-staple-42 is both easier to type and harder to crack than P@ssw0rd!23, because cracking difficulty is driven primarily by length and randomness, not by how many symbol categories you cram in. When a site forces you into a password you must type from memory (a device PIN, a computer login), favor length over cleverness.

Turn on breach monitoring

Most password managers include breach monitoring that checks your saved logins against known leaked-credential databases and flags anything exposed. Treat every alert as an action item: rotate that password immediately, and check whether you reused it anywhere else.

What to actually change today

• Install a password manager and import your existing logins.
• Change your email account password first — it's the recovery path for everything else — and make it unique.
• Let the manager auto-generate new passwords for your five most-used accounts this week, not all four hundred at once.
• Enable multi-factor authentication everywhere it's offered; a password alone, even a great one, is still a single point of failure.

The goal isn't a perfect system on day one. It's a system with enough friction removed that you'll still be using it a year from now.